How to fix auth/invalid-credential in Firebase

For signInWithEmailAndPassword, auth/invalid-credential almost always means the password is wrong or the account does not exist. With email enumeration protection enabled (the default for projects created since September 2023) Firebase deliberately returns one generic code for both so attackers cannot tell which emails are registered.

Do not try to distinguish the two cases or disable this protection just to get more detailed errors — that re-introduces an account enumeration vulnerability. Instead, show the user a single neutral message and let them retry or reset their password:

import { signInWithEmailAndPassword } from 'firebase/auth';

try {
  await signInWithEmailAndPassword(auth, email, password);
} catch (error) {
  if (error.code === 'auth/invalid-credential') {
    // Could be a wrong password OR an unknown email — by design.
    showMessage('Incorrect email or password. Try again or reset your password.');
  } else {
    throw error;
  }
}

If you genuinely need the older granular errors and accept the security trade-off, you can disable enumeration protection in Firebase Console > Authentication > Settings > User actions — but the neutral-message approach above is strongly preferred.

For OAuth providers, build the credential with exactly the fields that provider returns. A common mistake is passing a token under the wrong key or omitting idToken.

import { OAuthProvider, signInWithCredential } from 'firebase/auth';

// Apple: pass the idToken Apple returned. rawNonce must match the
// (unhashed) nonce you sent in the original authorization request.
const provider = new OAuthProvider('apple.com');
const credential = provider.credential({
  idToken: appleIdToken,
  rawNonce: rawNonce, // required if you sent a nonce
});

await signInWithCredential(auth, credential);

Note: Apple Sign-In is verified through the idToken (and matching nonce), not an accessToken. Passing a bogus accessToken will not fix a malformed credential. For Google, use GoogleAuthProvider.credential(idToken, accessToken) with the tokens your client actually obtained.

An unenabled or misconfigured provider produces auth/invalid-credential.

1. Open Firebase Console > Authentication > Sign-in method.
2. Enable each provider you use (Email/Password, Google, Apple, Facebook, etc.).
3. For OAuth providers, confirm the OAuth client ID/secret matches what is configured in the provider's own dashboard.
4. For Apple, verify the Service ID, Team ID, Key ID, and private key in the Apple provider settings.
5. For mobile, confirm GoogleService-Info.plist (iOS) / google-services.json (Android) and SHA fingerprints match this Firebase project.

OAuth ID tokens are short-lived. If you cache a credential and reuse it later, validation can fail. Always obtain a fresh token from the provider immediately before calling signInWithCredential, rather than persisting and replaying an old one.

For re-authentication before a sensitive action, prompt the user for a fresh credential:

import { reauthenticateWithCredential, EmailAuthProvider } from 'firebase/auth';

const credential = EmailAuthProvider.credential(user.email, currentPassword);
try {
  await reauthenticateWithCredential(user, credential);
} catch (error) {
  if (error.code === 'auth/invalid-credential') {
    showMessage('That password is incorrect. Please re-enter it to continue.');
  }
}

Multiple initializeApp calls or mixing credentials across projects can cause validation failures. Initialize once at module scope and reuse the instance:

import { initializeApp, getApps, getApp } from 'firebase/app';
import { getAuth } from 'firebase/auth';

const firebaseConfig = { /* your project config */ };
const app = getApps().length ? getApp() : initializeApp(firebaseConfig);
export const auth = getAuth(app);

Using getApps()/getApp() is important in hot-reload and SSR environments (e.g. Next.js) where modules can re-evaluate. Make sure the config corresponds to the same Firebase project as your providers and any Admin SDK service account.

Admin SDK token verification fails if the service account is from the wrong project or the server clock is skewed, since token expiry checks are time-sensitive.

Use a service account key from the matching project:

const admin = require('firebase-admin');
const serviceAccount = require('./service-account-key.json');

admin.initializeApp({
  credential: admin.credential.cert(serviceAccount),
});

Then confirm time is synchronized. On modern systemd-based Linux, enable NTP with timedatectl (the older ntpdate utility is deprecated and absent on most current distros):

# Check status
timedatectl status

# Enable automatic NTP synchronization
sudo timedatectl set-ntp true

Keep service account keys out of version control. Only regenerate a key (Console > Project Settings > Service Accounts > Generate New Private Key) if you suspect it was leaked or revoked.